Re: Detecting Blaster
From: James Riden (j.riden_at_massey.ac.nz)
Date: 08/14/03
- Previous message: Tim Mektrakarn: "DCOM patch + Exchange"
- In reply to: Bob Sadler: "Detecting Blaster"
- Next in thread: Bryan Schlegel: "RE: Detecting Blaster"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "Bob Sadler" <bobs@LEAWOOD.ORG> Date: Fri, 15 Aug 2003 08:33:01 +1200
"Bob Sadler" <bobs@LEAWOOD.ORG> writes:
> I have been trying to figure out if there is a way that I can detect
> signs of Blaster on a large number of machines on a network without
> having to actually visit each one.
>
> I have a port scanner (Ethereal) and have it setup to look at any frame
> with destination port 135. Is there a better way to do this, or is the
> way I'm trying to do this all wrong in the first place?
Scanning through port 135, incrementing the IP address by one each
time is pretty typical for this worm. But I'd use e.g. snort's
portscan detection to pull out the portscans and then do some analysis
with a perl script.
There's a lot of traffic out there and you don't want to be looking at
it by hand.
cheers,
Jamie
-- James Riden / j.riden@massey.ac.nz / Systems Programmer - Security GPG public key available at: http://www.massey.ac.nz/~jriden/ This post does not necessarily represent the views of my employer. --------------------------------------------------------------------------- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms ---------------------------------------------------------------------------
- Previous message: Tim Mektrakarn: "DCOM patch + Exchange"
- In reply to: Bob Sadler: "Detecting Blaster"
- Next in thread: Bryan Schlegel: "RE: Detecting Blaster"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
